CVE-2022-30304: XSS vulnerability due to AngularJS Client-Side Template injection
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.
Other sources
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2022-30304.
What is the severity level of CVE-2022-30304?
The severity level of CVE-2022-30304 is medium.
What is CWE-79?
CWE-79 refers to the improper neutralization of input during web page generation vulnerability.
Which versions of FortiAnalyzer are affected by CVE-2022-30304?
FortiAnalyzer versions prior to 7.2.1, 7.0.4, and 6.4.8 are affected by CVE-2022-30304.
How can a remote unauthenticated attacker exploit CVE-2022-30304?
A remote unauthenticated attacker can exploit CVE-2022-30304 by performing a stored cross-site scripting (XSS) attack via the observed URL parameter in the FortiWeb attack event.